Data Processing Agreement

This Data Processing Agreement (the Agreement) is between the customer and DealLaunch AI Ltd, a private limited company registered in England and Wales under company number 17423669 (DealLaunch AI). It applies where DealLaunch AI processes personal data on behalf of a customer in the course of providing the DealLaunch AI service. It forms part of, and is subject to, the DealLaunch AI Terms.

In this Agreement, the GDPR means Regulation (EU) 2016/679 and, where it applies instead or as well, the UK GDPR as defined in the Data Protection Act 2018. A reference to an Article of the GDPR includes the matching Article of the UK GDPR.

The customer is the controller of the personal data it puts into its workspace - including its contacts, counterparties, notes and correspondence. DealLaunch AI is the processor of that data. Where the customer is itself a processor for its own client, DealLaunch AI acts as a sub-processor on the same terms.

DealLaunch AI is a separate controller only for its own account and billing data, which is governed by the Privacy notice rather than this Agreement.

DealLaunch AI will process personal data only on the customer's documented instructions, which are given by the customer's use of the service and by this Agreement, unless required otherwise by applicable law - in which case DealLaunch AI will inform the customer before processing, unless that law prohibits it.

The subject matter is the provision of deal-workflow software. The duration is the term of the customer's subscription. The nature and purpose are the storage, organisation, transmission and retrieval of the customer's deal records and correspondence, including when its outreach emails are opened, and, on projects where automatic reply status is switched on, the automated reading of email from that project's contacts, and of replies to the customer's outreach from anyone else writing from the company domain of one of the project's firms, to set the contacts' status and, on those projects, the reading on DealLaunch AI's own servers, without any AI, of e-signature notices about those contacts and of the mail the customer sent them, to record a signed NDA or a CIM. The categories of data subject are the customer's business contacts, counterparties and its own personnel. The types of personal data are business contact details, professional role and firm, correspondence content, meeting notes and activity records, including when an outreach email was opened. Each outreach email carries a 1x1 image; when the recipient's mail app loads it, DealLaunch AI records the time against that contact and that email, and never records the recipient's IP address or browser. No special categories of personal data are required by the service, and the customer should not upload them.

DealLaunch AI will not sell personal data, will not use it for its own purposes, and will not use it to train artificial-intelligence models.

DealLaunch AI ensures that any person authorised to process personal data is bound by an obligation of confidentiality, and limits access to those who need it to provide, secure or support the service.

DealLaunch AI implements technical and organisational measures appropriate to the risk, including: encryption of data in transit and at rest; encryption of mailbox credentials at rest with AES-256-GCM, held server-side and never returned to a browser; per-workspace isolation enforced at the database layer by row-level security; private document storage reachable only through short-lived signed links; multi-factor authentication available on accounts; and an append-only record of material changes to a workspace.

The current state of these measures, including what is not yet in place, is published and kept current at deallaunch.ai/trust. The customer is responsible for the security of its own credentials, its own mailbox and the access it grants to its team.

The customer gives general authorisation for the sub-processors published at deallaunch.ai/sub-processors, which as at the date of this version of the Agreement are Supabase, Vercel, Anthropic, TypeSafe AI, RocketReach, Anymail Finder, Resend, Stripe.

DealLaunch AI will give at least 30 days' notice by email before a new sub-processor with access to workspace data begins processing, and will update the published list on the same day. If the customer reasonably objects on data-protection grounds within that period, it may terminate the affected part of the service without penalty and export its data.

DealLaunch AI imposes data-protection obligations on each sub-processor no less protective than those in this Agreement, and remains fully liable to the customer for their performance.

Outreach is sent directly from the customer's own mailbox, through Microsoft Graph or the customer's own SMTP server. Outreach has no mail sub-processor, and message content is not relayed through DealLaunch AI infrastructure for delivery. On a project where automatic reply status is switched on, the subject and text of each email from that project's contacts in the connected mailbox, and of each reply to the customer's outreach from anyone else writing from the company domain of one of the project's firms, with the names of its attachments (never the files themselves), the project codename, the client's name and the contact's current status, are sent to TypeSafe AI, a listed sub-processor, to set the status of that contact (for such a reply, a contact at that firm) and of their colleagues at the same firm on the project. Automatic reply status is switched on only at the customer's request and, for a customer that accepted an earlier version of this Agreement, not before 30 days after the notice described above.

Application server functions run in Frankfurt, Germany (fra1). The database and file storage are located in the region stated at deallaunch.ai/trust.

Where a sub-processor processes personal data outside the European Economic Area or the United Kingdom - which today applies to Anthropic, TypeSafe AI, RocketReach, Anymail Finder and Stripe, each listed in the United States on the sub-processor page - the transfer is made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, and subject to the supplementary measures described on the trust page.

Taking into account the nature of the processing, DealLaunch AI will assist the customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the customer's obligation to respond to requests from data subjects exercising their rights. The customer can satisfy most such requests itself, directly in the product, because it can search, correct, export and delete the records in its own workspace at any time.

DealLaunch AI will also provide the customer with reasonable assistance in relation to data-protection impact assessments and prior consultation with a supervisory authority, taking into account the information available to it.

DealLaunch AI will notify the customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the customer's data. The notification will describe the nature of the breach, the categories and approximate volume of data and data subjects affected so far as known, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not available at once, information will be provided in phases as it becomes available.

The customer may export at any time while its account is active, without notice to DealLaunch AI and without charge, from Settings then Security. The export is a JSON file of the records the signed-in account can see: deals, contacts outside the trash, document records, drafts, templates and the activity record. It holds only those records, so uploaded files, mandate and engagement terms, comments and reports are not in it, and any personal data in them is covered by the next paragraph.

On termination, DealLaunch AI will, at the customer's choice given by writing to hello@deallaunch.ai, return or delete the personal data it processes, and delete existing copies within 30 days, unless retention is required by applicable law. Routine encrypted backups are deleted on their normal rotation, within 90 days of termination.

DealLaunch AI will make available to the customer the information necessary to demonstrate compliance with Article 28 GDPR, including the published trust and sub-processor pages and reasonable answers to written security questionnaires.

Where that information is not sufficient for the customer's own regulatory obligations, DealLaunch AI will contribute to an audit conducted by the customer or an independent auditor mandated by it, on reasonable prior written notice, no more than once in any twelve-month period except following a personal data breach, during business hours, and subject to confidentiality.

This Agreement takes effect when the customer begins using the service or signs it, whichever is earlier, and continues for as long as DealLaunch AI processes personal data on the customer's behalf.

In the event of a conflict between this Agreement and the DealLaunch AI Terms in relation to the processing of personal data, this Agreement prevails.

This Agreement, and any dispute or claim arising out of or in connection with it, is governed by the law of England and Wales, as are the DealLaunch AI Terms, and the courts of England and Wales have exclusive jurisdiction, without prejudice to the mandatory rights of data subjects and the powers of supervisory authorities under applicable data-protection law.